Post Reply 
MCODE: Card_Reader 1G ROM
05-11-2019, 11:13 AM (This post was last modified: 05-11-2019 11:15 AM by Ángel Martin.)
Post: #1
MCODE: Card_Reader 1G ROM
Recently I've been looking into the Card_Reader 1G ROM to learn more about the section dealing with the HP-67 code conversion.

This ROM is a piece of work, fully packed and stuffed with tons of interesting tricks. Looking at the ROM contents it becomes clear that the Card_Reader was a difficult peripheral to control. I guess the breakthrough was the original models on with the HP-65 and 67, but the 41 implementation is a real masterpiece.

Anyway I was wondering if somebody had already disassembled the HP-67 code conversion part of the ROM, located at addresses E469 to E566 and E5A7 to E608. Those tables appear though to crack, I'd expect them to be some kind of mapping between HP-67 and HP-41 instruction codes but so far I haven't figured it out...

Best,
ÁM
Find all posts by this user
Quote this message in a reply
05-12-2019, 11:13 PM
Post: #2
RE: MCODE: Card_Reader 1G ROM
(05-11-2019 11:13 AM)Ángel Martin Wrote:  Recently I've been looking into the Card_Reader 1G ROM to learn more about the section dealing with the HP-67 code conversion.

This ROM is a piece of work, fully packed and stuffed with tons of interesting tricks. Looking at the ROM contents it becomes clear that the Card_Reader was a difficult peripheral to control. I guess the breakthrough was the original models on with the HP-65 and 67, but the 41 implementation is a real masterpiece.

Anyway I was wondering if somebody had already disassembled the HP-67 code conversion part of the ROM, located at addresses E469 to E566 and E5A7 to E608. Those tables appear though to crack, I'd expect them to be some kind of mapping between HP-67 and HP-41 instruction codes but so far I haven't figured it out...

Best,
ÁM

I haven't looked at it in detail, but the fact that it's revision -1G implies that it was a challenge to get right.
Visit this user's website Find all posts by this user
Quote this message in a reply
05-13-2019, 07:22 AM (This post was last modified: 05-13-2019 07:23 AM by Ángel Martin.)
Post: #3
RE: MCODE: Card_Reader 1G ROM
(05-12-2019 11:13 PM)Monte Dalrymple Wrote:  I haven't looked at it in detail, but the fact that it's revision -1G implies that it was a challenge to get right.

Yep, so I'm now looking for the "HP-67 Byte Table"- if such a thing ever existed?
I seem to remember an article on PPC dealing with the HP-67 instruction codes, but again, it might be just a figment of my imagination...

My guess is that there must be a look-up table mapping 67-instruction codes to 41-byte_table values. Time for another wading session...
Find all posts by this user
Quote this message in a reply
05-13-2019, 10:07 AM
Post: #4
RE: MCODE: Card_Reader 1G ROM
Here's one: http://www.panamatik.de/ProgramCodes.pdf
Find all posts by this user
Quote this message in a reply
05-13-2019, 04:44 PM
Post: #5
RE: MCODE: Card_Reader 1G ROM
(05-13-2019 07:22 AM)Ángel Martin Wrote:  Yep, so I'm now looking for the "HP-67 Byte Table"- if such a thing ever existed?
I seem to remember an article on PPC dealing with the HP-67 instruction codes, but again, it might be just a figment of my imagination...

My guess is that there must be a look-up table mapping 67-instruction codes to 41-byte_table values. Time for another wading session...

The initial HP-67 8-Bit Program Codes table appeared at the end of Louis Cargile's article, HP-67 Internal Codes and Quasi-Alphanumerics, from HP65 Notes Volume 4, Number 1, pages 5 - 8 (1977). Some of us remember Lou as the inventor of the HP-67 "Black Box", first described in 65 Notes V4N5 in his amazing article "Zen and the Art of HP-67 Maintenance", starting on page 4. Building that box was my very first soldering adventure :-)

Jake
Find all posts by this user
Quote this message in a reply
05-14-2019, 10:33 AM
Post: #6
RE: MCODE: Card_Reader 1G ROM
(05-13-2019 10:07 AM)Thomas Okken Wrote:  Here's one: http://www.panamatik.de/ProgramCodes.pdf

Perfect!, thanks very much Thomas.
Find all posts by this user
Quote this message in a reply
05-14-2019, 10:34 AM
Post: #7
RE: MCODE: Card_Reader 1G ROM
(05-13-2019 04:44 PM)Jake Schwartz Wrote:  The initial HP-67 8-Bit Program Codes table appeared at the end of Louis Cargile's article, HP-67 Internal Codes and Quasi-Alphanumerics, from HP65 Notes Volume 4, Number 1, pages 5 - 8 (1977). Some of us remember Lou as the inventor of the HP-67 "Black Box", first described in 65 Notes V4N5 in his amazing article "Zen and the Art of HP-67 Maintenance", starting on page 4. Building that box was my very first soldering adventure :-)

Jake

Yeah, those names do ring the bell...many thanks for the information, will follow up shortly.
Find all posts by this user
Quote this message in a reply
05-16-2019, 01:29 AM
Post: #8
RE: MCODE: Card_Reader 1G ROM
I can't believe its not GOT butter!
Is there really no commented source code for the Card Reader from HP ???

Angel, those spaces don't look like tables to me. To start with they only represent half the codes for the 67, also the codes that do fit are in higgledy-piggledy order - any responsible assembly table maker would have reduced the table order to 1,2,3,4... order. Next there doesn't seem to be any table addressing code in the whole of the card reader ROM, not even an offset address, by one or two bytes, i.e table 1 is at E469 so the search would be to look for an ld@ code having 9h as the last digit of a 4 digit address, but with an offset of a byte it would be 8h or if 16 bit offset it would be 7h, but none of these are apparent in the ROM. Its the same for the other table 2 at E5A7.
Its like the 1G updated version has some left over code that is not cleaned up from the previous version.
Just a few thoughts on the matter.
DA
Find all posts by this user
Quote this message in a reply
05-16-2019, 04:59 AM (This post was last modified: 05-16-2019 05:03 AM by Ángel Martin.)
Post: #9
RE: MCODE: Card_Reader 1G ROM
(05-16-2019 01:29 AM)derekamos Wrote:  I can't believe its not GOT butter!
Is there really no commented source code for the Card Reader from HP ???

Angel, those spaces don't look like tables to me. To start with they only represent half the codes for the 67, also the codes that do fit are in higgledy-piggledy order - any responsible assembly table maker would have reduced the table order to 1,2,3,4... order. Next there doesn't seem to be any table addressing code in the whole of the card reader ROM, not even an offset address, by one or two bytes, i.e table 1 is at E469 so the search would be to look for an ld@ code having 9h as the last digit of a 4 digit address, but with an offset of a byte it would be 8h or if 16 bit offset it would be 7h, but none of these are apparent in the ROM. Its the same for the other table 2 at E5A7.
Its like the 1G updated version has some left over code that is not cleaned up from the previous version.
Just a few thoughts on the matter.
DA

Hi Derek, thanks for chiming in. I'm half-way through the decoding of the tables, which I'm pretty sure there are active tables, even if decoding their logic requires more information than usually. (HP would not leave all that dead code there, it's MCODE heresy!)

For starters the table is exactly 256 bytes long, which provides a pretty good hint of its contents. Obviously one needs to follow the order defined by the HP-67 "byte table". Thanks to Thomas (and Eberhard) this was revealed to be the proper sequence of the words on the table starting at E467 (not at E469 as I first thought - thanks to Mike for that pointer as well).

As to the index or starting location, it's implicitly built in the call to the subroutine at E465: the call loads E467 in the return stack, from where it's picked up by the subroutine. The table offset (i.e. position to read) is expected to be in A.M on entry.

The logic fetches the word, and depending on the value of the XS nibble it interprets the word as :

a. if XS=0, a direct translation into an HP-41 byte code
b. if XS=3, one of the XROM id#'s from the card reader itself
c. if XS=1, the address of the location where the actual combination of instruction codes are to be found
d. if XS=2 - not clear yet....

All this is of very limited use since the HP-67 code cannot be read by the HP-41 directly unless thru the utilization of the card reader obviously - and separating it into an independent function doesn't seem to be very useful; it's just the challenge of course.

To be continued, this is just the beginning.
See below the gory details ;-)

Code:
E467    084    STOP    
E468    060    1/X    
E469    051    X^2    
E46A    052    SQRT    
E46B    04C    %    
E46C    1C7    -> S+   [TB_1C7]
E46D    053    Y^X    
E46E    050    LN    
E46F    055    E^X    
E470    04F    R-P    
E471    059    SIN    
E472    05A    COS    
E473    05B    TAN    
E474    04E    P-R    
E475    085    RTN    
E476    3A3    ???      A3:A3 - 7RCLN
E477    010    0    
E478    011    1    
E479    012    2    
E47A    013    3    
E47B    014    4    
E47C    015    5    
E47D    016    6    
E47E    017    7    
E47F    018    8    
E480    019    9    
E481    01A    ,    
E482    083    ENTER^    
E483    25F    -> CHS   ???
E484    01B    EEX    
E485    043    /    
E486    000    VOID    
E487    089    PSE    
E488    062    FACT    
E489    1C4    -> MEAN  [TB_1C4]
E48A    1CA    -> SDEV  [TB_1CA] 
E48B    04D    %CH    
E48C    1CD    -> S-    [TB_1CD]
E48D    061    ABS    
E48E    056    LOG    
E48F    057    10^X    
E490    068    INT    
E491    05C    ASIN    
E492    05D    ACOS    
E493    05E    ATAN    
E494    069    FRC    
E495    06E    RND    
E496    000    VOID    
E497    071    X<>Y    
E498    075    RDN    
E499    077    CLX    
E49A    399    ENG      A3:99 - 7ENG
E49B    39A    FIX      A3:9A - 7FIX
E49C    3A2    PRTX     A3:A2 - 7PRTX
E49D    3A4    SCI      A3:A4 - 7SCI
E49E    040    +    
E49F    041    -    
E4A0    042    *    
E4A1    06A    D-R    
E4A2    06B    R-D    
E4A3    06C    HMS    
E4A4    06D    HR    
E4A5    1F3    -> STO (i)    
E4A6    1F5    -> RCL (i)    
E4A7    049    HMS+    
E4A8    08F    ADV    
E4A9    3A1    STK    
E4AA    076    LASTX    
E4AB    387    W/DATA    
E4AC    381    MERGE   A3:81 - MRG
E4AD    1F7    X<> I    
E4AE    074    R^    
E4AF    072    PI    
E4B0    080    DEG    
E4B1    081    RAD    
E4B2    082    GRAD    
E4B3    39F    P<>S     A3:9F - 7P<>S
E4B4    38B    CLREG    A3:8B - 7CLRG
E4B5    3A0    REG      A3:A0 - 7PRREG
E4B6    000    NULL    
E4B7    079    X#Y?    
E4B8    078    X=Y?    
E4B9    045    X>Y?    
E4BA    063    X#0?    
E4BB    067    X=0?    
E4BC    064    X>0?    
E4BD    066    X<0?    
E4BE    046    X<=Y?    
E4BF    1C2    -> FS? 0 [TB_1C2]
E4C0    1C2    -> FS? 1    
E4C1    1FD    FS? 2    
E4C2    1FF    FS? 3    
E4C3    39D    ISZ      A3:9D - 7ISZ
E4C4    39E    ISZ(I)   A3:9E -  7ISZI
E4C5    397    DSZ      A4:97 - 7DSZ
E4C6    398    DSZ(i)    
E4C7    1A7    DSP 0    
E4C8    1A7    DSP 1    
E4C9    1A7    DSP 2    
E4CA    1A7    DSP3    
E4CB    1A7    DSP 4    
E4CC    1A7    DSP 5    
E4CD    1A7    DSP 6    
E4CE    1A7    DSP 7    
E4CF    1A7    DSP 8    
E4D0    1A7    DSP 9    
E4D1    1A9    CF 0    
E4D2    1A9    CF 1    
E4D3    1A9    CF 2    
E4D4    1F9    CF 3    
E4D5    000    VOID    
E4D6    396    DSP(i)    A3:96 - 7DSP
E4D7    020    RCL 00    
E4D8    021    RCL 01    
E4D9    022    RCL 02    
E4DA    023    RCL 03    
E4DB    024    RCL 04    
E4DC    025    RCL 05    
E4DD    026    RCL 06    
E4DE    027    RCL 07    
E4DF    028    RCL 08    
E4E0    029    RCL 09    
E4E1    1AB    RCL A    
E4E2    1AB    RCL B    
E4E3    1AB    RCL C    
E4E4    1AB    RCL D    
E4E5    1AB    RCL E    
E4E6    1AB    RC I    
E4E7    1AD    ST/ 0    
E4E8    1AD    ST/ 1    
E4E9    1AD    ST/ 2    
E4EA    1AD    ST/ 3    
E4EB    1AD    ST/ 4    
E4EC    1AD    ST/ 5    
E4ED    1AD    ST/ 6    
E4EE    1AD    ST/ 7    
E4EF    1AD    ST/ 8    
E4F0    1AD    ST/ 9    
E4F1    1AF    SF 0    
E4F2    1AF    SF 1    
E4F3    1AF    SF 2    
E4F4    1FB    SF 3    
E4F5    000    VOID    
E4F6    201    STO/ (i)    
E4F7    030    STO 00    
E4F8    031    STO 01    
E4F9    032    STO 02    
E4FA    033    STO 03    
E4FB    034    STO 04    
E4FC    035    STO 05    
E4FD    036    STO 06    
E4FE    037    STO 07    
E4FF    038    STO 08    
E500    039    STO 09    
E501    1B1    STO A    
E502    1B1    STO B    
E503    1B1    STO C    
E504    1B1    STO D    
E505    1B1    STO E    
E506    1B1    ST I    
E507    1B3    ST- 0    
E508    1B3    ST- 1    
E509    1B3    ST- 2    
E50A    1B3    ST- 3    
E50B    1B3    ST- 4    
E50C    1B3    ST- 5    
E50D    1B3    ST- 6    
E50E    1B3    ST- 7    
E50F    1B3    ST- 8    
E510    1B3    ST- 9    
E511    1B5    GSB A    
E512    1B5    GSB B    
E513    1B5    GSB C    
E514    1B5    GSB D    
E515    1B5    GSB E    
E516    203    GSB (i)    
E517    1B8    ST= 0    
E518    1B8    ST+ 1    
E519    1B8    ST+ 2    
E51A    1B8    ST+ 3    
E51B    1B8    ST+ 4    
E51C    1B8    ST+ 5    
E51D    1B8    ST+ 6    
E51E    1B8    ST+ 7    
E51F    1B8    ST+ 8    
E520    1B8    ST+ 9    
E521    1B8    GTO a    
E522    1B8    GTO b    
E523    1B8    GTO c    
E524    1B8    GTO d    
E525    1B8    GTO e    
E526    39B    ST+ (i)    
E527    1BB    GTO 0    
E528    1BB    GTO 1    
E529    1BB    GTO 2    
E52A    1BB    GTO 3    
E52B    1BB    GTO 4    
E52C    1BB    GTO 5    
E52D    1BB    GTO 6    
E52E    1BB    GTO 7    
E52F    1BB    GTO 8    
E530    1BB    GTO 9    
E531    1BD     GTO A    
E532    1BD     GTO B    
E533    1BD    GTO C    
E534    1BD    GTO D    
E535    1BD    GTO E    
E536    205    GTO (i)    
E537    276    STX 0    
E538    276    STX 1    
E539    276    STX 2    
E53A    276    STX 3    
E53B    276    STX 4    
E53C    276    STX 5    
E53D    276    STX 6    
E53E    276    STX 7    
E53F    276    STX 8    
E540    276    STX 9    
E541    276    LBL a    
E542    276    LBL b    
E543    276    LBL c    
E544    276    LBL d    
E545    276    LBL e    
E546    39C    STX (i)    
E547    1C0    LBL 0    
E548    1C0    LBL 1    
E549    1C0    LBL 2    
E54A    1C0    LBL 3    
E54B    1C0    LBL 4    
E54C    1C0    LBL 5    
E54D    1C0    LBL 6    
E54E    1C0    LBL 7    
E54F    1C0    LBL 8    
E550    1C0    LBL 9    
E551    1DF    LBL A    
E552    1E3    LBL B    
E553    1E7    LBL C    
E554    1EB    LBL D    
E555    1EF    LBL E    
E556    207    LBL (i)    
E557    001    LBL 00    
E558    002    LBL 01    
E559    003    LBL 02    
E55A    004    LBL 03    
E55B    005    LBL 04    
E55C    006    LBL 05    
E55D    007    LBL 06    
E55E    008    LBL 07    
E55F    009    LBL 08    
E560    00A    LBL 09    
E561    1D0        
E562    1D3        
E563    1D6        
E564    1D9        
E565    1DC        
E566    000    NOP
Find all posts by this user
Quote this message in a reply
05-16-2019, 11:56 AM
Post: #10
RE: MCODE: Card_Reader 1G ROM
Thats OK Angel, I figured you might like the assembly-code insights, & you were red-hot with spying out the 2-byte offset to the table address. Even if its not in line-code that is readily readable.

The table looks like an ugly SOB, not something I would want to decode!

That brings me to the 2nd table, it doesn't seem have an E5A7 or an offset-E5A5 address in the ROM, that I could see?

I'll just wish you good luck with that one. DA
Find all posts by this user
Quote this message in a reply
Post Reply 




User(s) browsing this thread: 1 Guest(s)